1. Field of the Invention
The present invention generally relates to packet switched network communications and, more particularly, a method and apparatus which provides the ability to allow a TCP/IP client situated outside of an organization's "firewall" to address a server inside the same firewall, even when the firewall is configured to not allow outside clients to address the inside server.
2. Background Description
The Internet is a collection of networks throughout the world which facilitates the sharing of resources among participating organizations, including government agencies, educational institutions and private corporations. These networks use the Transmission Control Protocol/Internet Protocol (TCP/IP) protocol suite and share a common address space. Thus, computers on the Internet use compatible communications standards and share the ability to contact each other and exchange data. Users of the Internet communicate mainly via electronic mail (e-mail), via Telnet, a process that allows users to log in to a remote host, and via implementations of the File Transfer Protocol (FTP), a protocol that allows them to transfer information on a remote host to their local site.
Security is a major concern when connecting a network, such as a local area network (LAN) to the Internet. One of the more important concerns is intruders attempting to gain access to local hosts. A common method for preventing these types of intrusions is to install a so-called "firewall" which is a secure single point of attachment to the Internet. This single point of attachment takes the form of a firewall host which allows only certain traffic to pass through as specified by the firewall administrator. In a typical firewall host implementation, a user wanting to transfer a file on a host in the LAN to an external host via the Internet first transfers the file to the firewall host and then logs into the firewall and transfer the file to the external host. While this procedure provides a high level of security for a single user, maintaining security becomes difficult as the number of users requiring access to this host increases. For general information on firewalls, see William R. Cheswick and Steven M. Bellovin, Firewalls and Internet Security, Addison-Wesley (1994).
A transport layer proxy architecture, called SOCKS, was created in an attempt to minimize security problems while allowing access by a large number of users. See, for example, David Koblas and Michelle R. Koblas, "SOCKS",UNIX Security Symposium, USENIX Association (1992), pp. 77-83, and Ying-Da Lee, "SOCKS: A protocol for TCP proxy across firewalls", http://www.socks.nec.com/socks4.protocol, and M. Leech, M. Ganis, Y. Lee, R. Kuris, D. Koblas, and L. Jones, "SOCKS Protocol Version 5", ftp://ds.internic.net/rfc/rfc1928.txt. In a transport layer proxy architecture, one end system behind the firewall, which is called the client, initiates a session by making a connection to the proxy, which can be thought of as residing on the firewall. The client and proxy use the connection to exchange messages negotiating session setup information such as authentication or proxy request (e.g., the foreign host to connect to for a firewall proxy or the URL (Uniform Resource Locator) to fetch for an HTTP (Hypertext Transfer Protocol) proxy). The proxy then carries out the request, commonly opening a connection to another end-system, typically outside the firewall, which is called the server, as directed by the client. The proxy may exchange session setup information with the server over the connection. After session setup has been completed on both connections, the proxy begins to copy data back and forth between the two connections and does not delete from, add to, or alter the information flowing between the hosts (although it may silently keep a copy of the information, as in the case of HTTP caching proxies).
Often, an employee inside an organization wishes to allow an "outside" client to address his or her "inside" server. In this case, since the employee trusts the outside client, he or she may wish to bypass the controls put in place on the firewall so that the trusted outside client can address the trusted inside server.